QUOTE(Andres Martinez Andrade @ Jan 10 2008, 01:34 AM)
If you check the referrer is enough to kick a hacker out or there exists another good practices for enhancing security in php scripts that process forms?
Checking the referrer is a good practice but in my opinion is not enough, because it can also be faked, for this situation you can implement some type of IP checking. If the IP has not visited the specific page shortly prior to calling the script, deny access. For example the following code can be used to get the user's IP address:
CODE
<?php
$ip=$_SERVER["REMOTE_ADDR"];
?>
Another good practice for enhancing security in php scripts is to validate for the correct method -POST or GET- that you use in your form, it is recomended that never use the $_REQUEST variable, if you use it for your validations you don't know which method is used, because this variable can handle both methods.
For example, if you use the POST method to send your form, it is very easy to validate it with the following code:
CODE
<?php
if($_SERVER['REQUEST_METHOD'] != "POST"){
echo("Unauthorized attempt to access page.");
exit;
}
?>
Best regards,
Comment/Reply (w/o sign-up)
